CVE-2009-4227: Buffer Overflow
PEDAMACHEPHEPTOLIONES and D.B. COOPER found a stack-based buffer overflow, present in Xfig, Transfig by loading malformed .FIG files. A remote attacker could provide a specially-crafted .FIG text object file, which once opened by a local, unsuspecting user would lead to denial of service (Xfig, fig2dev crash).
References: ----------- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=559274
Fortran PoC by PEDAMACHEPHEPTOLIONES: ------------------------------------- http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=xfigpoc.f;att=1;bug=559274
CVE was requested here: ----------------------- http://www.openwall.com/lists/oss-security/2009/12/03/2
Other sources
Stack-based buffer overflow in the read13textobject function in freadold.c in Xfig 3.2.5b and earlier, and in the readtextobject function in read13.c in fig2dev in Transfig 3.2.5a and earlier, allows remote attackers to execute arbitrary code via a long string in a malformed .fig file that uses the 1.3 file format. NOTE: some of these details are obtained from third party information.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-4227?
CVE-2009-4227 has a high severity due to the potential for remote code execution via a stack-based buffer overflow.
How do I fix CVE-2009-4227?
To mitigate CVE-2009-4227, users should update to versions of Xfig that are greater than 3.2.5b.
Who is affected by CVE-2009-4227?
CVE-2009-4227 affects users of Xfig version 3.2.5 and earlier versions.
What type of vulnerability is CVE-2009-4227?
CVE-2009-4227 is classified as a stack-based buffer overflow vulnerability.
Can CVE-2009-4227 lead to data loss?
Yes, exploiting CVE-2009-4227 can lead to denial of service, which may result in data loss.